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DETAILED ACTION 

Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U S C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1-10 and 22-24 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Zenchelsky et al. (US 6,173,364) in view of Spinney et al. (US 
6,226,267) and further in view of Sendrowicz (US 2003/0163554). 

Regarding claim 1, Zenchelsky et al. discloses a method for managing traffic in a 
communications network comprising acts of: (a) providing, in a network device, a cache 
containing at least predefined characteristics associated with packets and actions 
paired with selected ones of said predefined characteristics (column 3, lines 63-67 and 
column 4, lines 1-2, where the key is a predefined characteristic and actions are paired 
together with it in the cache, the cache being used for filtering packets in a 
communication network, and is in a network device as seen in column 1, lines 51-59, a 
network device being a filter); (b) receiving at least one of the packets in said network 
device (column 1, lines 60-62); (c) selecting, from said received packet, characteristics 
similar to the at least predefined characteristics (column 1 , lines 60-66); (d) correlating 
the characteristics selected from said received packet with the predefined 
characteristics (column 4, lines 2-6); and (f) identifying data packets with the most 
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bundling when compared to other data packets (column 4, lines 1-6, where the first 
packet received is part of a series of packets with the same key, seen as a bundle of 
packets). Zenchelsky et al. does not disclose using the results from the correlating step 
to perform Layer 3 or higher classification of the received packet; or initializing an 
expiration timer that controls a frequency at which the cache is aged, wherein the 
expiration timer corresponds to an expected burst interval of the identified packets. The 
general concept of using a cache containing predetermined packet characteristics and 
their associated actions to classify Layer 3 or higher packets is well known in the art as 
illustrated by Spinney et al. Spinney et al. teaches a system where packets 
classification is performed at Layer 3 or higher (column 2, lines 18-28, where the system 
classifies Layer 4 packets), and the system uses a cache table to classify packets by 
using already seen packets for assistance (column 8, lines 38-45, where a packets is 
hashed and matched against previous flows of packets). It would have been obvious to 
one of ordinary skill in the art at the time of invention to modify Zenchelsky et al. with 
Layer 3 or higher packet classification as taught by Spinney et al. in order to increase 
the efficiency of packet classification as to increase bandwidth to streaming applications 
as noted in Spinney et al.'s disclosure in column 2, lines 2-15. The general concept of 
initializing an expiration timer that controls a frequency at which the cache is aged, 
wherein the expiration timer corresponds to an expected burst interval of the identified 
packets is also well known in the art as illustrated by Sendrowicz. Sendrowicz 
describes a cache system for packet processing where entries in the cache are set to 
be deleted upon a average transmission time observed for the packet (section 0087, 
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section 0148, and section 0218, where the DD cache is used for discarding packets 
already seen by the cache, and the cache entry is created with a expiration time based 
on an average communication time, and this timer is updated as more cache hits are 
encountered, seen as setting an expiration timer for a cache entry using an expected 
burst time of the packet). It would have been obvious to one of ordinary skill in the art at 
the time of invention to modify Zenchelsky et al. and Spinney et al. with using cache 
expirations based on expected burst intervals as taught by Sendrowicz in order to 
control the cache entries and limit duplication of the packets as noted in Sendrowicz's 
disclosure in section 0244. 

Regarding claim 2, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 1 , and Zenchelsky et al. further teaches wherein the process 
includes enforcing the paired action against the received packet if the characteristics of 
said received packet matches the at least predefined characteristics (column 4, lines 6- 
8). 

Regarding claim 3, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 1 or claim 2, and Zenchelsky et al. further teaches wherein the at 
least predefined characteristics include Internet Protocol (IP) Destination Address (DA), 
IP Source Address (SA), Transmission Control Protocol (TCP) Destination Port (DP) 
and TCP Source Port (SP) (column 2, lines 1-25, with the filtering being based on 
source address and port and destination address and port). 
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Regarding claim 4, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 1 , and Zenchelsky et al. further teaches wherein the correlating act 
includes comparing (column 4, lines 2-3, wherein matching is equivalent to comparing). 

Regarding claim 5, Zenchelsky et al. discloses a method comprising the acts of: 
providing in a memory a mapping of predefined characteristics associated with packets 
and actions to be performed (column 3, lines 63-67 and column 4, lines 1-2, where the 
keys are predefined characteristics and the action are paired together in the memory); 
receiving packets to be classified (column 4, lines 2-3); correlating selected 
characteristics of received packets with the predefined characteristics (column 4, lines 
2-4); performing stored actions on said received packets, if the selected characteristics 
match the predefined characteristics (column 4, lines 6-8); and identifying data packets 
with the most bundling when compared to other data packets (column 4, lines 1-6, 
where the first packet received is part of a series of packets with the same key, seen as 
a bundle of packets). Zenchelsky et al. does not disclose having actions include Layer 
3 or higher frame classification actions, or initializing an expiration timer that controls a 
frequency at which the cache is aged, wherein the expiration timer corresponds to an 
expected burst interval of the identified packets. The general concept of using a cache 
containing predetermined packet characteristics and their associated actions to classify 
Layer 3 or higher packets is well known in the art as illustrated by Spinney et al. 
Spinney et al. teaches a system where packets classification is performed at Layer 3 or 
higher (column 2, lines 18-28, where the system classifies Layer 4 packets), and the 
system uses a cache table to classify packets by using already seen packets for 
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assistance (column 8, lines 38-45, where a packets is hashed and matched against 
previous flows of packets, and then it is appropriately scheduled and routed, seen as 
actions). It would have been obvious to one of ordinary skill in the art at the time of 
invention to modify Zenchelsky et al. with Layer 3 or higher packet classification as 
taught by Spinney et al. in order to increase the efficiency of packet classification as to 
increase bandwidth to streaming applications as noted in Spinney et al.'s disclosure in 
column 2, lines 2-15. The general concept of initializing an expiration timer that controls 
a frequency at which the cache is aged, wherein the expiration timer corresponds to an 
expected burst interval of the identified packets is also well known in the art as 
illustrated by Sendrowicz. Sendrowicz describes a cache system for packet processing 
where entries in the cache are set to be deleted upon a average transmission time 
observed for the packet (section 0087, section 0148, and section 0218, where the DD 
cache is used for discarding packets already seen by the cache, and the cache entry is 
created with a expiration time based on an average communication time, and this timer 
is updated as more cache hits are encountered, seen as setting an expiration timer for a 
cache entry using an expected burst time of the packet). It would have been obvious to 
one of ordinary skill in the art at the time of invention to modify Zenchelsky et al. and 
Spinney et al. with using cache expirations based on expected burst intervals as taught 
by Sendrowicz in order to control the cache entries and limit duplication of the packets 
as noted in Sendrowicz's disclosure in section 0244. 
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Regarding claim 6, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 5, and Zenchelsky et al. further teaches wherein the correlating act 
includes comparing (column 4, lines 2-3, wherein matching is equivalent to comparing). 

Regarding claim 7, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 5, and Zenchelsky et al. further teaches wherein the predefined 
characteristics include Source Address (SA), Destination Address (DA), Source Port 
(SP), and Destination Port (DP) (column 2, lines 1-25, with the filtering being based on 
source address and port and destination address and port). 

Regarding claim 8, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 5, and Zenchelsky et al. further teaches wherein the received 
packets are data packets (column 2, lines 1-5, where the packets used for filtering are 
involved in application processes, seen as data packets) 

Regarding claim 9, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 5, and Zenchelsky et al. further teaches wherein the stored actions 
associated with predefined characteristics are updated only from a first packet of a 
group of packets (column 3, lines 65-67 to column 4, lines 1-2, where a filter rules are 
applied only to a first packet in a message that shares a same key and the cache is 
updating only from the filter rule base). 

Regarding claim 10, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the method of claim 9, and Zenchelsky et al. further teaches wherein the stored actions 
are being performed on all packets following the first packet of the group of packets 
(column 4, lines 8-10). 
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Regarding claim 22, Zenchelsky et al. discloses a system including a memory 
that stores a mapping between predefined characteristics of packets and actions to be 
performed for a subset of the set of all characteristic values (column 3, lines 63-67, 
where the key is the predefined characteristic paired with an action, and the memory is 
derived from a filter rule base, therefore containing a subset of characteristics derived 
from already received packets); and a controller that performs the following actions: 
correlates characteristics in a received packet with the predefined characteristics and 
performing the actions on said received packet if the characteristics match the 
predefined characteristics (column 4, lines 2-8, where the received packet is searched 
against the predefined characteristics and the paired action is applied to the packet if a 
match is found). Zenchelsky et al. also discloses identifying data packets as being 
frequent flyer packets (column 4, lines 1-6, where the first packet received is part of a 
series of packets with the same key, seen as a series of packets). Zenchelsky et al. 
does not disclose actions that classify Layer 3 or higher packets, or initializing an 
expiration timer that controls a frequency at which the cache is aged, wherein the 
expiration timer corresponds to an expected burst interval of identified packets being 
frequent flyer packets. The general concept of using a cache containing predetermined 
packet characteristics and their associated actions to classify Layer 3 or higher packets 
is well known in the art as illustrated by Spinney et al. Spinney et al. teaches a system 
where packets classification is performed at Layer 3 or higher (column 2, lines 18-28, 
where the system classifies Layer 4 packets), and the system uses a cache table to 
classify packets by using already seen packets for assistance (column 8, lines 38-45, 
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where a packets is hashed and matched against previous flows of packets, and then it 
is appropriately scheduled and routed, seen as actions). It would have been obvious to 
one of ordinary skill in the art at the time of invention to modify Zenchelsky et al. with 
Layer 3 or higher packet classification as taught by Spinney et al. in order to increase 
the efficiency of packet classification as to increase bandwidth to streaming applications 
as noted in Spinney et al.'s disclosure in column 2, lines 2-15. The general concept of 
initializing an expiration timer that controls a frequency at which the cache is aged, 
wherein the expiration timer corresponds to an expected burst interval of the identified 
packets being frequent flyer packets is also well known in the art as illustrated by 
Sendrowicz. Sendrowicz describes a cache system for packet processing where 
entries in the cache are set to be deleted upon a average transmission time observed 
for the packet (section 0087, section 0148, and section 0218, where the DD cache is 
used for discarding packets already seen by the cache, and the cache entry is created 
with a expiration time based on an average communication time, and this timer is 
updated as more cache hits are encountered, seen as setting an expiration timer for a 
cache entry using an expected burst time of the packet or any repeat similar packet). It 
would have been obvious to one of ordinary skill in the art at the time of invention to 
modify Zenchelsky et al. and Spinney et al. with using cache expirations based on 
expected burst intervals as taught by Sendrowicz in order to control the cache entries 
and limit duplication of the packets as noted in Sendrowicz's disclosure in section 0244. 

Regarding claim 23, Zenchelsky et al. discloses a computer readable medium 
comprising computer-executable instructions that, when executed by a processor, 
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produce a method that comprises: correlating characteristics of a received packet with 
characteristics in a table (column 4, lines 2-4, where a cache memory is searched for a 
matching entry, seen as characteristics in a table, when a packet is received), said table 
containing a subset of all possible characteristic values (column 3, lines 63-67, where 
the cache memory is derived from a filter rule base, therefore containing a subset of 
characteristics derived from already received packets); and enforcing an action stored in 
said table on the received packet if the characteristics of the received packet and the 
characteristics in the table match (column 4, lines 6-8, where the received packet is 
searched against the predefined characteristics and the paired action is applied to the 
packet if a match is found). Zenchelsky et al. also discloses identifying data packets as 
being frequent flyer packets (column 4, lines 1-6, where the first packet received is part 
of a series of packets with the same key, seen as a series of packets). Zenchelsky et 
al. does not disclose actions that facilitate Layer 3 or higher packet classification, or 
updating the contents of the table at times that correspond to an expected burst interval 
of identified packets being frequent flyer packets. The general concept of using a cache 
containing predetermined packet characteristics and their associated actions to classify 
Layer 3 or higher packets is well known in the art as illustrated by Spinney et al. 
Spinney et al. teaches a system where packets classification is performed at Layer 3 or 
higher (column 2, lines 18-28, where the system classifies Layer 4 packets), and the 
system uses a cache table to classify packets by using already seen packets for 
assistance (column 8, lines 38-45, where a packets is hashed and matched against 
previous flows of packets, and then it is appropriately scheduled and routed, seen as 
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actions). It would have been obvious to one of ordinary skill in the art at the time of 
invention to modify Zenchelsky et al. with Layer 3 or higher packet classification as 
taught by Spinney et al. in order to increase the efficiency of packet classification as to 
increase bandwidth to streaming applications as noted in Spinney et al.'s disclosure in 
column 2, lines 2-15. The general concept of updating a table that controls a frequency 
at which the cache is aged, wherein the expiration timer corresponds to an expected 
burst interval of the identified packets being frequent flyer packets is also well known in 
the art as illustrated by Sendrowicz. Sendrowicz describes a cache system for packet 
processing where entries in the cache are set to be deleted upon a average 
transmission time observed for the packet (section 0087, section 0148, and section 
0218, where the DD cache is used for discarding packets already seen by the cache, 
and the cache entry is created with a expiration time based on an average 
communication time, and this timer is updated as more cache hits are encountered, 
seen as setting an expiration timer for a cache entry using an expected burst time of the 
packet or any repeat similar packet). It would have been obvious to one of ordinary skill 
in the art at the time of invention to modify Zenchelsky et al. and Spinney et al. with 
using cache expirations based on expected burst intervals as taught by Sendrowicz in 
order to control the cache entries and limit duplication of the packets as noted in 
Sendrowicz's disclosure in section 0244. 

Regarding claim 24, Zenchelsky et al., Spinney et al., and Sendrowicz disclose 
the computer readable medium of claim 23, and Zenchelsky et al. further teaches 
including instructions to generate the table containing the characteristics and associated 
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actions (column 3, lines 63-67 and column 4, lines 1-2, where generating the table 

consists of adding a cache entry for each first packet received). 

3. Claims 11-13 and 15 are rejected under 35 U.S.C. 103(a) as being unpatentable 

over Hughes et al. (US 5,842,040) in view of Spinney et al (US 6,226,267) and further 

in view of Zaumen et al. (US 6,1 18,760) and further in view of Sendrowicz (US 

2003/0163554). 

Regarding claim 11, Hughes et al. discloses a system including a processor 
(column 2, lines 54-57); a cache operatively coupled to said processor (column 3, lines 
36-39), said cache storing a mapping between predefined characteristics of packets and 
actions wherein said processor executes a first program that causes said processor to 
correlate characteristics of selected packets with the predefined characteristics (column 
2, lines 57-60, where the policy is selected from a plurality of policies matched to the 
received PDU packet, these policies being seen as equivalent to characteristics of 
packets) and enforcing on said selected packets actions associated with predefined 
characteristics if characteristics from the selected packets match the predefined 
characteristics (column 3, lines 5-9, where the PDU has a policy applied to it from the 
policy cache). Hughes et al. does not disclose a memory operatively coupled to said 
processor and storing therein: a first data structure for a full packet search wherein said 
processor executes a second program that causes said processor to access the first 
data structure and imposing on said selected packet an action stored in said first data 
structure if a mismatch occurs between the predefined characteristics and the 
characteristics from the selected packets, or setting the expiration timer to correspond 
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to an expected burst interval of packets identified as frequent flyer packets. The 
general concept of including a data structure for a full packet search if a mismatch 
occurs is well known in the art as illustrated by Spinney et al. Spinney et al. describes a 
system that performs packet classification using a cache, but also uses a full table in the 
case of a cache table mismatch (column 7, lines 26-32, where the fast pattern matching 
is not appropriate or fails, the entire Hash table is used for packet lookup). It would 
have been obvious to one of ordinary skill in the art at the time of invention to modify 
Hughes et al. with full table lookup on cache lookup mismatch as taught by Spinney et 
al. in order to expedite the packet classification as to increase the efficiency of packet 
classification to increase bandwidth to streaming applications as noted in Spinney et 
al.'s disclosure in column 2, lines 2-15. Hughes et al. and Spinney et al. do not teach a 
second data structure that includes an aging algorithm for aging the cache, the aging 
algorithm initializes an expiration timer, decrements the expiration timer by a check time 
interval that is less than a current value of the expiration timer, reviews a Layer 3 or 
Layer 4 database for a change to the Layer 3 or Layer 4 database, and purges the 
cache if a change has been made during the check time interval, or setting the 
expiration timer on an expected burst interval of packets identified as being frequent 
flyer packets. The general concept of including such a timing algorithm is well known in 
the art as illustrated by Zaumen et al. Zaumen et al. describes a system for 
management of the cache memory. Zaumen et al. sets a first timer when a new block is 
created (seen as a expiration timer), and then starts a second timer (seen as a check 
time interval) when the first timer runs out if the block is still active. The process repeats 
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with every second time expiration, and in this process, the block is checked for its state 
of activity (seen as reviewing a database for changes in the database), and once it is 
inactive, the system deletes the entry if the entry in the database becomes inactive. 
This whole procedure is described in column 8, lines 21-51. Zaumen et al.'s system 
can be used for Layer 3 or 4 packets as noted in column 5, lines 7-1 1 . It would have 
been obvious to one of ordinary skill in the art at the time of invention to modify Hughes 
et al. and Spinney et al. with using an aging algorithm as taught by Zaumen et al. in 
order to efficient use of the memory available as noted in Zaumen et al.'s abstract. The 
general concept of initializing an expiration timer that controls a frequency at which the 
cache is aged, wherein the expiration timer corresponds to an expected burst interval of 
the identified packets being frequent flyer packets is also well known in the art as 
illustrated by Sendrowicz. Sendrowicz describes a cache system for packet processing 
where entries in the cache are set to be deleted upon a average transmission time 
observed for the packet (section 0087, section 0148, and section 0218, where the DD 
cache is used for discarding packets already seen by the cache, and the cache entry is 
created with a expiration time based on an average communication time, and this timer 
is updated as more cache hits are encountered, seen as setting an expiration timer for a 
cache entry using an expected burst time of the packet or any repeat similar packet, 
seen as a frequent flyer stream). It would have been obvious to one of ordinary skill in 
the art at the time of invention to modify Hughes et al., Spinney et al., and Zaumen et al. 
with using cache expirations based on expected burst intervals as taught by Sendrowicz 
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in order to control the cache entries and limit duplication of the packets as noted in 
Sendrowicz's disclosure in section 0244. 

Regarding claim 12, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose the system of claim 11, and Hughes et al. further teaches wherein 
the predefined characteristics include Source Address (SA), Destination Address (DA), 
Source Port (SP) and Destination Port (DP) (column 5, lines 30-45, with the policies 
including filtering based on these criteria or any combination of criteria). 

Regarding claim 13, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose the system of claim 1 1 , and Hughes et al. further teaches wherein 
the processor includes a network processor (column 2, lines 50-57, with any network 
device including a processor can perform this process). 

Regarding claim 15, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose the system of claim 1 1 , and Hughes et al. further teaches having 
the packets used for caching include received packets as required by claim 15 (column 
2, lines 63-65-, with a PDU being a packet received). 

4. Claims 16-21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hughes et al. (US 5,842,040), Spinney et al. (US 6,226,267), Zaumen et al. (US 
6,1 18,760), and Sendrowicz as applied to claim 1 1 above, and further in view of Bass et 
al. (US 6,460,120 B1). 

Regarding claim 16, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose all of the limitations as described above except for using a full 
match algorithm to search the table. The general concept of using a full match 
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algorithm is well known in the art as illustrated by Bass et al. Bass et al. discloses 
frame lookups in a table using a fixed match tree (column 8, lines 1-3, where a fixed 
match tree requires an exact match, which is seen as being equivalent to a full match). 
It would have been obvious to one of ordinary skill in the art at the time of invention to 
modify Hughes et al., Spinney et al., Zaumen et al., and Sendrowicz with using a full 
match search algorithm as taught by Bass et al. in order to use known search 
algorithms to increase speed and flexibility as noted in Bass et al.'s disclosure in column 
3, lines 18-20. 

Regarding claim 17, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose all of the limitations as described above except for using a longest 
prefix match algorithm to search the table. The general concept of using a longest 
prefix match algorithm is well known in the art as illustrated by Bass et al. Bass et al. 
discloses frame lookups in a table using a longest prefix match tree (column 8, lines 1- 
5). It would have been obvious to one of ordinary skill in the art at the time of invention 
to modify Hughes et al., Spinney et al., Zaumen et al., and Sendrowicz with using a 
longest prefix match search algorithm as taught by Bass et al. in order to use known 
search algorithms to increase speed and flexibility as noted in Bass et al.'s disclosure in 
column 3, lines 18-20. 

Regarding claim 18, Hughes et al., Spinney et al.-, Zaumen et al., and 
Sendrowicz disclose all of the limitations as described above except for using software 
managed tree algorithm to search the table. The general concept of using a software 
managed tree algorithm is well known in the art as illustrated by Bass et al. Bass et al. 
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discloses frame lookups in a table using a software-managed tree (column 8, lines 1-8). 
It would have been obvious to one of ordinary skill in the art at the time of invention to 
modify Hughes et al., Spinney et al., Zaumen et a!., and Sendrowicz with using a 
software managed tree search algorithm as taught by Bass et al. in order to use known 
search algorithms to increase speed and flexibility as noted in Bass et al.'s disclosure in 
column 3, lines 18-20. 

Regarding claims 19 and 20, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose all of the limitations as described above except for having the 
memory internal or external to the processor. The general concept of placing the 
memory external or internal to a processor is well known in the art as illustrated by Bass 
et al. Bass et al. has memory external to the processors, but the combination of 
memory and processors create a network processor system (Abstract). It would have 
been obvious to one of ordinary skill in the art at the time of invention to modify Hughes 
et al., Spinney et al., Zaumen et al., and Sendrowicz with using memory external to the 
processor and also internal to the entire network processor as taught by Bass et al. in 
order to create a network processor in one physical unit as to save money and space, 
and increase the flexibility of the network processor as noted in Bass et al.'s disclosure 
in column 3, lines 18-20. 

Regarding claim 21, Hughes et al., Spinney et al., Zaumen et al., and 
Sendrowicz disclose all of the limitations as described above except for using a Direct 
Table and Patricia tree as the data structure. The general concept of using a Direct 
Table and Patricia tree is well known in the art as illustrated by Bass et al. Bass et al. 
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discloses a frame lookup method using a Direct Table and Patricia Tree (column 25, 
lines 54-61). It would have been obvious to one of ordinary skill in the art at the time of 
invention to modify Hughes et al., Spinney et al., Zaumen et al., and Sendrowicz with 
using a Direct Table and Patricia tree as taught by Bass et al. in order to use known 
data to increase speed and flexibility as noted in Bass et al.'s disclosure in column 3, 
lines 18-20. 

5. Claims 31 and 34-35 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Hughes et al. (US 5,842,040) in view of "Filters to Detect, Filters to Protect" 
(McLachlan et al.) and further in view of Sendrowicz (US 2003/0163554). 

Regarding claim 31, Hughes et al. discloses a method of classifying packets in a 
communications network comprising acts of: (a) receiving packets in a network device 
(column 2, line 61); (b) determining data packets present in received packets (column 3, 
lines 15-24, with grouping the packets together by any field could include TCP flag 
information as seen in column 5, lines 34-44, and this classification can inherently 
determine if it's a data packet or a non-data packet (data packets do not set the 
Synchronize flag or the Finish flag)); (c) providing a cache in which predefined 
characteristics of packets and actions associated with selected ones of the predefined 
characteristics are stored (column 3, lines 36-39, where policy data is seen as 
predefined characteristics); for each data packet so determined, correlating selected 
characteristics of said each data packet with the predefined characteristics in said 
cache (column 3, lines 27-31 ); and for each data packet with selected characteristics 
matching one of the predefined characteristics imposing on said each data packet the 
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action associated with said one of the predefined characteristics (column 3, lines 30-35, 
where policies are applied to matching packets with the matching policy information), 
wherein the packets include TCP/IP packets (column 14, lines 14-18), and wherein the 
determining act further includes the acts of: examining the control bits in the TCP 
header (column 5, line 41 , where the TCP flags are found in the TCP header). Hughes 
et al. does not disclose if selected ones of the control bits are set to a first state, 
examining a length field in the IP header to determine its value, multiplying a value in 
the data offset field in the TCP header by 4, and subtracting the result of the 
multiplication from the value in the length field, or identifying packets as frequent flyer 
packets and updating the contents of the cache at times that correspond to an expected 
burst interval of packets identified as frequent flyer packets. The general concept of 
performing these mathematical operations to determine the TCP data if one of the 
control bits are set to a first state is well known in the art as illustrated by McLachlan et 
al. McLachlan et al, describes setting up a packet filter to discriminate or classify 
packets. On pages 9-10, McLachlan et al. describes the steps necessary to extract the 
TCP payload length. First, a check for a SYN flag is made, seen as a control bit being 
set to a first state, and then the TCP header length (seen as offset field) is multiplied by 
4 and subtracted from the IP header length. It would have been obvious to modify 
Hughes et al. with extracting TCP payload information as taught by McLachlan et al. in 
order to examine fields in the TCP for certain kinds of activity as noted in McLachlan et 
al.'s page 1 . The general concept of updating an expiration timer that controls a 
frequency at which the cache is aged, wherein the expiration timer corresponds to an 
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expected burst interval of the identified packets being frequent flyer packets is also well 
known in the art as illustrated by Sendrowicz. Sendrowicz describes a cache system for 
packet processing where entries in the cache are set to be deleted upon a average 
transmission time observed for the packet (section 0087, section 0148, and section 
0218, where the DD cache is used for discarding packets already seen by the cache, 
and the cache entry is created with a expiration time based on an average 
communication time, and this timer is updated as more cache hits are encountered, 
seen as setting an expiration timer for a cache entry using an expected burst time of the 
packet or any repeat similar packet, seen as a frequent flyer stream). It would have 
been obvious to one of ordinary skill in the art at the time of invention to modify Hughes 
et al and McLachlan et al. with using cache expirations based on expected burst 
intervals as taught by Sendrowicz in order to control the cache entries and limit 
duplication of the packets as noted in Sendrowicz's disclosure in section 0244. 

Regarding claims 34-35, Hughes et al., McLachlan et al., and Sendrowicz teach 
the method of claim 31 as described above, with McLachlan further teaching the first 
state being a logical "0" and having the selected ones of the control bits include SYN, 
FIN, and RST flags. The general concept of examining these control bits in the TCP 
header and checking to see if they are a logical "0" is well known in the art as illustrated 
by McLachlan et al. McLachlan et al. teaches checking for the SYN flag explicitly and 
then checking the TCP payload length, however this involves masking byte 13 of the 
TCP header to retrieve the control bits (page 7). The mask returns a number 
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corresponding to what control bits are set, and what control bits are at a logical "0". 
Byte 13 is displayed in Figure 17.5, and example mask returns are listed in page 8. 
This is seen as checking SYN, FIN, and RST flags and also determining logical "0's" 
before examining the TCP payload length. It would have been obvious to modify 
Hughes et al., McLachlan et al., and Sendrowicz with using any one of the selected 
TCP control bits and checking for a logical "0" before extracting TCP payload 
information as taught by McLachlan et al. in order to examine fields in the TCP for 
certain kinds of activity as noted in McLachlan et al.'s page 1 . 

Response to Arguments 

6. Applicant's arguments with respect to claims 1-13, 1 5-31 , and 34-35 have been 
considered but are moot in view of the new ground(s) of rejection. 

Summary and Responses to Arguments 
A. Applicant argues the rejection under 35 U.S.C. 103(a) as being 
unpatentable under Zenchelsky et al. in view of Spinney et al. for claims 1-10 and 22- 
29, as the references fail to teach the amended claimed limitations. 

As to point A, applicant's arguments are moot in view of the new grounds of 
rejection under 35 U.S.C. 103(a) as being unpatentable under Zenchelsky et al, 
Spinney et al., and Sendrowicz. The prior art references Zenchelsky et al., Spinney et 
al., and Sendrowicz create a prima facie case of obviousness. 
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B. Applicant argues the rejection under 35 U.S.C. 103(a) as being 
unpatentable under Hughes et al. in view of Spinney et al. and further in view of 
Zaumen et al. for claims 11-15, as the references fail to teach the amended claimed 
limitations. 

As to point B, applicant's arguments are moot in view of the new grounds of 
rejection under 35 U.S.C. 103(a) as being unpatentable under Hughes et al, Spinney et 
al., Zaumen et al. and Sendrowicz. The prior art references Hughes et al., Spinney et 
al., Zaumen et al., and Sendrowicz create a prima facie case of obviousness. 

C. Applicant argues the rejection under 35 U.S.C. 103(a) as being 
unpatentable under Hughes et al., Spinney et al. in view of Zaumen et al., and further in 
view of Bass et al. for claims 16-21 , as the references fail to teach the amended claimed 
limitations. 

As to point B, applicant's arguments are moot in view of the new grounds of 
rejection under 35 U.S.C. 103(a) as being unpatentable under Hughes et al, Spinney et 
al., Zaumen et al., Sendrowicz, and Bass et al. The prior art references Hughes et al., 
Spinney et al., Zaumen et al., Bass et al. and Sendrowicz create a prima facie case of 
obviousness. 

D. Applicant argues the rejection under 35 U.S.C. 103(a) as being 
unpatentable under Hughes et al. in view of Filters for claims 31-35, as the references 
fail to teach the amended claimed limitations. 
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As to point d, applicant's arguments are moot in view of the new grounds of 
rejection under 35 U.S.C. 103(a) as being unpatentable under Hughes et al, Filters, and 
Sendrowicz. The prior art references Hughes et al., Filters, and Sendrowicz create a 
prima facie case of obviousness. 

Conclusion 

7. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .1 36(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Adam S. Weintrop whose telephone number is 571-270- 
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1604. The examiner can normally be reached on Monday through Friday 7:30am- 
5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jason Cardone can be reached on 571-272-3933. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

AW 6/21/07 




